If this turns out to be tricky, you might consider whether using text2pcap
would be easier. This takes a hex dump of your packets and generates a
pcap file. It ships with Wireshark and its manpage is at
http://www.wireshark.org/docs/man-pages/text2pcap.html. To use this you'll
need to write some code to take your capture and translate it in to the
dump format.
Andy.
From: Lange Jan-Erik <jan-erik.la...@haw-hamburg.de>
To: "gsslist+wiresh...@anthropohedron.net"
<gsslist+wiresh...@anthropohedron.net>, Developer support list for
Wireshark <wireshark-dev@wireshark.org>
Date: 11/10/2010 14:21
Subject: Re: [Wireshark-dev] saving data in pcap file format
Sent by: wireshark-dev-boun...@wireshark.org
Ok, in the documentation of winpcap I found the function pcap_dump_open().
It opens a file for another function ...loop() with captures packet and
saves it in this file.
But I have to open the file and have to write my data in this file.. not
captureing it with this loop() function. It is possible to insert my data
into a struct and then save this structure into a .pcap file?
I need the "low-level" description of this file format. It should be
possible to implement an own easy function to save the data.
________________________________________
Von: wireshark-dev-boun...@wireshark.org
[wireshark-dev-boun...@wireshark.org] im Auftrag von Gregory Seidman
[gsslist+wiresh...@anthropohedron.net]
Gesendet: Montag, 11. Oktober 2010 13:53
An: wireshark-dev@wireshark.org
Betreff: Re: [Wireshark-dev] saving data in pcap file format
On Mon, Oct 11, 2010 at 01:35:17PM +0200, Lange Jan-Erik wrote:
> Hello,
>
> I want to analyze an usb datastream with wireshark. To record the data I
use a proprietary development that uses libusb to receive the data.
>
> Ok, to analyze the data I want to use wireshark. Is there a way to save
the recorded data as a *.pcap File? Is there a library I could use to
write the data into a file? Can you an recommend overview about this file
format?
>
> When I have this pcap file I would create a dissector plugin to dissect
the data according to my protocoll.
You are looking for libpcap (or WinPcap on Windows). Works like a charm,
and has lots of language bindings (I've used it with Ruby).
> Best regards
> Jan
--Greg
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
IMPORTANT - CONFIDENTIALITY NOTICE - This e-mail is intended only for the
use of the addressee/s above. It may contain information which is
privileged, confidential or otherwise protected from disclosure under
applicable laws. If the reader of this transmission is not the intended
recipient, you are hereby notified that any dissemination, printing,
distribution, copying, disclosure or the taking of any action in reliance
on the contents of this information is strictly prohibited. If you have
received this transmission in error, please immediately notify us by reply
e-mail or using the address below and delete the message and any
attachments from your system.
Amadeus Services Ltd, World Business Centre 3, 1208 Newall Road, Hounslow,
Middlesex, TW6 2TA, Registered number 4040059___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
